California journalists sued for ‘hacking’ city’s open Dropbox folder; barred from publishing
In a complaint filed in the California Superior Court of Orange County on Oct. 24, 2019, the City of Fullerton, California, accused a community blog and two contributors of violating anti-hacking laws for accessing confidential files city employees posted online, according to their lawyer Kelly Aviles and court documents reviewed by the Committee to Protect Journalists. Aviles told CPJ in December that the suit could go to a jury trial in early 2020. The press freedom and legal advocacy group Reporters Committee for Freedom of the Press called the case the “first … we’re aware of where the computer crime laws have been misused so brazenly against members of the news media.”
The City of Fullerton claims that the blog, Friends for Fullerton’s Future, and two of its journalists, Joshua Ferguson and David Curlee, accessed more than a dozen internal documents stored on the file hosting and sharing service Dropbox without permission, according to CPJ’s review. The blog publishes original articles and commentary on the city government and the local police department.
Aviles alleged, in a phone interview with CPJ, that the case is designed to retaliate against her clients for reporting and to block future publication. She told CPJ she has filed an anti-Strategic Lawsuit Against Public Participation motion, or SLAPP, which permits courts to dismiss lawsuits that are intended to censor public speech.
“The City’s suit was not in retaliation for anything,” Fullerton’s lawyer Kimberly Hall Barlow wrote in an email to CPJ. The blog was not a factor in the decision to bring the case, she said.
“If the argument is that a reporter can steal information him or herself and then be allowed to publish it at will, that is neither consistent with the first amendment law nor the ethical tenets of professional journalists,” she said.
Ferguson routinely requested public records, and the city had provided him with a link to the Dropbox folder in the past, he told CPJ. The city acknowledges sending a link to access the folder in response to records requests, according to court filings reviewed by CPJ. The folder was not password protected, and anyone could access it via the web address in the link. Files that were approved for public release were kept in the same folder as others that had not been, some of which were password protected, according to those documents.
The complaint said Ferguson and Curlee accessed files in the folder that had not been approved for release, thereby violating the Computer Fraud and Abuse Act, a federal law intended to combat hacking, and a similar state law, the California Comprehensive Computer Data Access and Fraud Act. CPJ has reported concerns that the CFAA’s broad wording could be used to punish routine online journalistic activity.
The complaint said the journalists had intentionally obscured their activity using a virtual private network and the Tor browser — digital security tools that CPJ and others routinely recommend that journalists use online. The City also requested a forensic analysis of the reporters’ computers and sought prior restraint to block future publication based on the files — a request that RCFP called “concerning” and Aviles called unconstitutional in court documents.
In November, a trial court in Orange County did not allow that forensic examination, according to Aviles, while an appeals court stayed the attempt to block future publication in December. But the anti-hacking lawsuit against the blog is ongoing, Aviles told CPJ.
“The city is calling me a hacker and a thief,” Ferguson told CPJ in December. Yet, he said, “the idea they are presenting — that hacking is just clicking a link — that idea would literally break the internet if broadly applied.”
“The conduct that the City complains of is no more criminal than clicking through the City’s website, finding confidential information, and downloading it,” Aviles wrote in court filings reviewed by CPJ. The city’s lawsuit is in “retaliation for Mr. Ferguson’s CPRA lawsuit and to silence the Blog,” she wrote. Immediately before the city launched its lawsuit, Ferguson had filed a California Public Records Act lawsuit requesting the release of documents related to alleged police misconduct, he told CPJ.
Kimberly Hall Barlow told CPJ that the city decided to file their suit before Ferguson filed his.
Ferguson told CPJ that the city’s complaint included Christopher Tennyson, his former co-worker at a local camera store where they sometimes shared the same computer, in order to damage Ferguson’s professional relationships. Kimberly Hall Barlow denied this, noting to CPJ that the city later dropped Tennyson from the suit.
Aviles said the case was draining her clients’ financial resources and impeding their ability to continue reporting.
“It would be hard for a large newspaper to deal with this,” Aviles told CPJ in November. “But for a blog of concerned citizen journalists — who felt like there was no voice in their community — it’s an outrageous thing to face.”
RCFP filed an amicus brief in support of the bloggers, as did the Electronic Frontier Foundation, a leading U.S. digital rights group. The editorial board of the local Orange County Register newspaper published an editorial in November asking the city to drop the case and “get some professional advice on how to password-protect its files.”
Superior Court Judge James Crandall ruled to allow the city of Fullerton, California, to pursue its lawsuit against local blog Friends for Fullerton’s Future and two of its reporters on March 12, 2020.
The city alleges that FFFF and journalists Joshua Ferguson and David Curlee violated state and federal anti-hacking laws by illegally accessing and downloading city files that had been uploaded to the city’s Dropbox account. Ferguson and Curlee, who were given the link to the Dropbox by the city, maintain that the account was accessible by the general public and that retrieving the documents was part of normal newsgathering activities.
In his ruling, Crandall denied FFFF’s motion to dismiss the suit under California’s anti-SLAPP provision, which permits courts to dismiss lawsuits that are intended to censor public speech and require the plaintiff to pay attorney’s costs and fees.
Kelly Aviles, attorney for FFFF, told the U.S. Press Freedom Tracker that they have filed an appeal, as responding to dozens of declarations and briefs have driven up FFFF’s attorney’s fees and costs.
“Without having a way to recover their fees, anybody — but especially a small news organization that’s just covering a local city — they could be in real financial trouble with this,” Aviles said.
While this prior restraint was technically dropped, Crandall approved a proposed preliminary injunction by the city, also documented by the Tracker, once again barring the blog from publishing, sharing or destroying a number of city documents.
In resolving pending motions, Fourth Appellate District Judge Raymond Ikola dropped the temporary restraining order on March 26, noting that it was rendered moot when Crandall granted the preliminary injunction.
The City of Fullerton reached a settlement agreement with local blog Friends for Fullerton’s Future and two of its reporters on May 12, 2021.
The city had alleged in 2019 that FFFF and journalists Joshua Ferguson and David Curlee violated state and federal anti-hacking laws by illegally accessing and downloading city files that had been uploaded to the city’s Dropbox account. Ferguson and Curlee, who were given the link to the file hosting service by the city, maintain that the account was accessible by the general public and that retrieving the documents was part of normal newsgathering activities.
“Based on the City’s additional investigation and through discussions with Mr. Ferguson and Mr. Curlee, the City now understands that documents were not stolen or illegally taken from the shared file account as the City previously believed and asserted,” the settlement agreement reads. “Rather, the documents were made inadvertently available by the City in response to [Public Records Act] requests.”
According to the settlement agreement, Ferguson and Curlee agreed to return or delete the remaining copies of the documents they determined were not newsworthy. The city agreed to then publish a statement on its website acknowledging the error and pay both reporters $60,000 in damages and cover $230,000 of their attorneys’ fees.
Kelly Aviles, the attorney who represented Ferguson and Curlee, told the Voice of OC that the settlement exonerated her clients.
“They [the City of Fullerton] admitted that they were wrong, that my clients never did anything wrong,” Aviles said. “But more importantly they admit exactly what happened, which is the city’s error. They put documents online without having proper access controls.”
While the lawsuit against FFFF was pending, two Orange County Superior Court judges issued separate rulings barring the blog from publishing documents obtained from the city’s Dropbox account. Both prior restraints were ultimately struck down by the 4th District Court of Appeals, Voice of OC reported.